Protection against cybercrime is about preparation, education and technical infrastructure.
Being prepared before an attack is essential, not only for protecting the financial interests and reputation of your business but also from the perspective of legal responsibility. It is unusual for companies in this day and age not to process and/or store customer data in one form or another and with this data comes security responsibilities and requirements. The information below provides an overview of information and data security requirements plus links to helpful resources for businesses working on implementing a cybercrime business-continuity plan.
To fully protect your business, here are the steps to address:
The Office of the Australian Information Commissioner (OAIC) is an independent statutory agency within the Attorney General's portfolio. The OAIC deals with three main functions - privacy, freedom of information and government information policies. With regard to businesses and IT security, the OAIC operates the Notifiable Data Breach (NDB) scheme.
The NDB scheme was launched on 22 February 2018 and is relevant to ‘agencies and organisations regulated under the Australian Privacy Act 1988’. The NDB scheme oversees and provides guidelines for organisations in the event that a data breach occurs that involves the personal information of individuals being accessed by unauthorised persons.
Useful resources include:
The PCI Security Standards Council is a global forum for the payments industry. Handling customer credit card details is a huge responsibility and must be done securely. The PCI Security Standards Council works to develop, enhance, disseminate and assist with the understanding of security standards for payment account security.
Useful resources include:
In addition to security measures that protect your business-critical data, business leaders also need to be knowledgeable about and possibly compliant with GDPR. Does your business comply with the European Union’s General Data Protection Regulation? Is it applicable to you? Even if you are a small business based in Australia GDPR may be relevant to you:
"From 25 May 2018 Australian businesses of any size may need to comply with the GDPR if they have an establishment in the European Union (EU), if they offer goods and services in the EU, or if they monitor the behaviours of individuals in the EU." Source: General Data Protection Regulation guidance for Australian businesses
To actually block an attack from a cybercriminal a strong technical infrastructure that covers all gateways to the outside is necessary. This means implementing solid business continuity processes such as antivirus and malware-prevention applications, backups, firewalls and remote maintenance and monitoring technology to enforce good security practice across an organisation and keep all workstations up-to-date and running efficiently.
IT Basecamp offers a workstation cybersecurity bundle that provides all this protection at an affordable cost for SME’s.
Contact us to discuss customised IT solutions for protecting your business from cybercrime.
This is the easiest and fastest way to make an impact on your protection against cybercrime. Two-factor authentication adds a second layer of security to an account, so even if a hacker does discover your password, your account is still secure. Your business is instantly less vulnerable if your critical applications are protected by 2-factor authentication. It relies on knowledge and possession - the ‘knowledge’ is something you know, ie your password, and the ‘possession’ is something you have access to, ie an authentication code or key (usually via your phone). Without both of these, your identity cannot be verified and access to the account is denied.
IMPORTANT NOTE: Take the time to do the full set up and complete the backup recovery contacts and recovery codes. It is important. If for some reason you lose access to one or other of your verification methods (you forget your password for example, or lose your phone) you WILL need a backup method. Once 2-factor authentication is set up your account is now secure, remember? You, too, will be denied access if you cannot properly verify your identity.
A dedicated, independent backup procedure that captures all your business data provides solid protection in the event of a ransomware attack. A ransomware attack is when a hacker gains access to your systems and encrypts business data, demanding a ransom payment to unlock your systems. In addition to the ransom demand, businesses usually face days of down-time as the attack is sorted out. According to Datto research, downtime resulting from a ransomware attack is 23 times greater than the ransom amount itself. If you are running a robust, independent backup solution your business will not be at the mercy of hackers in this scenario. Instead, your business can retrieve a copy of all data from the backup and carry on.
If you find yourself in the situation where you have just clicked a link and realise you have given access to a hacker, there are things you can do instantly to try and contain the problem. A cyber attack relies on access to the Internet, so break the connection ASAP. This has to be done fast - remove the network cable, unplug the router, switch off the WiFi, shutdown the PC. Then get IT support and explain exactly what you did to enable the attack.
Having policies and procedures in place that create mindfulness of cybercrime can make a significant impact on catching attacks before damage takes place. Currently, the most common cyber attacks are Business Email Compromise. This is when a hacker gains access to an email account and exploits the trust of users to carry out fraud. For instance, upon gaining access to the MD's email account a hacker might send an email to the admin staff requesting money is transferred to a new business account. In reality, the new business account is actually the hackers and relies on the trust of the admin staff to follow the MD's instructions. If this company has procedures in place whereby any email request involving the transfer of funds must always be verbally confirmed with the MD there is an instant safety net in place and the opportunity to avoid the scam.
The SANS Institute is a global, cooperative research and education organisation established in 1989 to help the entire information security community. As well as providing training and security certification SANS develops, maintains, and makes available at no cost a large collection of research documents about various aspects of information security. It also operates the Internet's early warning system - the Internet Storm Centre.
Keep yourself and your staff knowledgeable and up-to-date. If staff know the types of methods and techniques scammers and hackers use, they are likely to recognise and identify a scam rather than falling victim to it. Scamwatch is a good source for keeping up-to-date in this area.
Assess your business’s insurance coverage and talk to your insurance company to decide if your current policy covers you in the event of a cyber attack - the fallout from a data breach can be enormous costs, fines, stress and loss of time; having an insurance policy where resources step in to pay costs and enact the cleanup can be business-saving!
The cleanup and repair costs associated with a fire or theft are easy to imagine, but the repercussions of a cyber attack can be harder to picture. Depending on the type of cyber attack these can include the obvious first-party costs such as:
Then there are third party costs including:
As well as coverage for these potential costs a cyber insurance policy can also offer support such as: